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Abstract: 

Provided is an attacker trace back method for tracing the hacking of a certain data, 
system or service in the global network environment of the Internet. In the prior art, since 
each host has a different method and format of recording log information the attack 
pathway of the hacker is analyzed by hand. Especially when the hacker falsifies his/her IP 
(Internet Protocol) address it is impossible to trace the hacker with only the log information 
left in the host. However in the attacker traceback method the network* s location in which 
the hacker resides is traced even when the hacker falsifies his/her IP address and via 
various networks launches cyber attacks such as a Denial of Service (DOS), which stops 
service. Therefore companies, government organizations or even countries can be better 
prepared against cyber attacks from domestic and overseas hackers with a safer and more 
reliable Internet environment guaranteed. 
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^ ^^S^ g^^(g!obal)of:>11 Ol^OiXI^ oH^(hacker)^ (host) Oil CWm ^^^21 ^'^S^e ihXjoF^e S¥/ai|9H2| 6H& 

6^01 oH^:^f MJ^\^ ^XHofe ^^MM ^^5HLH£^ offe g^XF ^ &^SOil S^e.^ SiOICf. ^2H2| ^§ ^:^^^::'f £[HI2i 

^ M^^^ 4^ 2i°U ^2^XfS ^^^^ gia. Ilfaf/H, S^XFOll CHS^ CHee m ^ mmOW. S^X[D\ OIS S^OII AFgtHS U|^o,3^2f 

Cf^ L-||M?4B0il ^^MS S^5HAH e^o^ m.^^0\\ QloH III 2. 3S\ 4^'2i^pir. 01 [IH0ilfe4^:?l ^§ arfie:?^ ^5H 

^ ^DiieJOilAH 01 g^QILMJJH.El^SxIM SiHK ^ ^^S^.' ^SSI OI^^M 5S|gsV A{|<i3 SSH 21E^^ 

M 3^£^ AhOlhH 5^011 ^^XfHI ^xlM ^<^oh£^ °[C|. [3>2|A1, UIM^-IB ^2}0\\ 9JiO\ gCH a^f^OIH ^S^Si S.9}m D\^o[ 

:his g^xfsj mx\m ^^o\o\ B^^i s^x^oii 2iaH oi^oixi^ xii 2. 321 ^^xi^^ 4- 

CHS£ 
£2 

£ 1^ #eH2i LiiM^B ae^ol oi^oixife Dii^iuee uBtH ?^5e. 

£E 3^ e ^^soii {d!/d::»f oiS5foi M^m 3 ^se asopi 9\m ^^o\o\ m UEfyi :?h^^£e. 
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280 : 281 : eUE^^ 

290 : ^r^M 291 : 

292 : £0112] ^d! AHtH 293 : HI 811 m.±^ 

^ ^'SB 3E(code)ei Ol^^e ^go^ §S 5+5.l(sesston data managemenOM ^ ^^SOI| 5!^^, ^51, 

g(giobai)a^:>]i 01^01X1^ aH^(hacker)2i ^^^(host)oii cAm ^^^21 ^EJg^M i^xl5^^g 6H3i2j aHiT ^mm ^^mcA m^J[ U 

^ o^s^?^rs^x^sl si (traffic) e x^ysi soiiej giipoiiAi x^Bmoi m^^m ^9iDm\ Q\m ^eoii xi^mn 9x0. 

o\9\ sens] soiiei^ ^ s^i^u ^^x[m ^mm sia. n^a^Ai, g^x^oii cHei aiee 4= 

IH^OiL JP^ Oia S^Oll AfgfWQj Lil^^jast UIM?4a01l ^^^M S^5H/H ^^e[ S:^^01l OloH 2, 321 

^nm 4^ ai^QL 01 ffHoiife ^m^imM oi g^oii chsh ois ^x\m mm aa. 

170)M ^blth £0liei(180)e eJEiyi(internet)o^^Ei°l X[^o[^m ^^QQ. 

e £soii $^oiAi, £0iiei{i80)e 2i¥ eieii^iie esH ^^(iio)o^s. SDneidsooii Mxm M±m^^60)s ^ 
ai Ai^g](i7o)2^ 4oi Ah^e eathci. 

^9} A|^lj(170)g ij^l^XI A|^gj(160)o^^Ei A^^M eS^^O^ £01|Oi(1 80)2J gj^Oll ^xlS AI:^g(150)S ^^^A|^ 

eiai^iiM mm m^m s^x[s\ mbh^m x\BM^Q(^40). 

^^#§f £ i3f s¥ eiEiyis #5H moisfe s^x^^¥E^ £Diioi(i80)g ^^o\m aixieh ^^ms ^gafoi xh 

s^oiife s^xfsi MeH^ie 4^ mmm. oioixi^ ^1 2, m 3 ^si g^e B\^m ^mm ^q. 

^ ^'^s ^mge aH^ah::?! ?]a^oi 2}mm 5^^^, 3H2j oi§^e ^ge.^ aii^ s^ais ean 2JEiy! ^^sj s^^s 3^°^ 
Moiw g^oii oisHAit g^xfsi ^5ia^£^ ois^s ^§§.^ Aii<:^ §s 5^B.is eth g^i^ ^ ^^sg m^m^ ai 

Al^^gjOII SiOIAI, ^^ms\ M\^m SUE{il{monitoring)a^^ 3iE^ Ol¥01^l SUEi^ dlAHM s^^^ eiEi^M SBH 



^9\0\ Q^9\ ^::^M(290. 291, 293)01! ^^QiS HUEli! ^A1(2B1):?h 2| m.^^2\ 2! Ail^M^ 21 2| SLIEi g 5Jia:?^ ^A1(280)£| e 

^xf g^s^sM sie (iH ^Ai{28o)oii:?ii s^x^ s^s^ssm Hlgo^£^ ^^ea. m^x[ s^s^ss^ oiis. g^x^ 

e ES01I S^OlAi, 2iX-i HUEiij ^Ai(281)^ 3H(program code)^. ^ ^^^{290. 291. 293)0il eiayig S6H £^XH 

£|0i 2| m>iM(290, 291, 293)2J Mli^m eUEiile^a. ^Al(280)fe 2| s:±:M(290, 291. 293)011 2,^2,^ ^JH^ eLl£^lj >s!!Ai(28 

i):?F fi^oii 9\m mss[^ ^^x[j[ 012011 s^sjie ar^^^on s^s^sas ^ssf^ai g^xp^ A^gs^ sr^^^sj ¥ixi 

S ^ ^^s[CK ^l!Ai^ ^eh^^^ MgaH ai^ £b^^ 3H(mobile code)^Al, eJEiyiOli S^S ^^^01! m^mM eXHAI^ 4^ 2A 

a. 

011^. 5i£i^xi Ai>iijg EI6H s^s(293):?^ eiEi^ie mm ^^^m 301 ^xiae 01 s^^^^ M^e x^^si sEoiiej Mm^ es(2io) 
soiiei A^td^fe g^&e.^ a^^§ gjej&^xi M±^^^^Ei g>s ^ai(280)s hish ^^^(293)^ ^^(2^2)mo. 
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3^ m^^(291)^ ojEHyie mm 01^(220, 231)E^a. 01 HH. SOIloig ^U/d Olgo^^ 6H& SOiiej S^ei >MtH(292)^VEi Ai|AI(2 
80)oj eieS ^'^CK221, 230). 

^s!IAi(280)^ ^^^(291)0i|A1 SUEH^ ^Ai(281)^^Ei ^^Xh:?^ dFS OlSOil ^^^21 s.±^9\ §SS mm232)Bm SHtJ 
^^^^ eiEi'iljg S8H OieSH/H ^n21o\0\ S^g goi ^^^(290)S ^^SjSH tilCf. 

Oi:?|A1, Q^2\ ^:^m290. 291, 293)M eiEi^e ^6H 9»i All ^(access) 8^ A1 SUElg {i!iA](281)S 01^^ 

£ 3^ ^ ^^SOII {£}&: ^A-|(280):?h ^^^(290. 291. 293)M 01^0^01 3¥ 3 S^^oF:^! ^m i^^^OlO^ m 

UEj-tn D^^5i^. m.t^^m ?§6Pi diM(36om x•llxll(380):p^ ^j^sm h^3^(370)^ ^gxii:^ii ^^o^|A^ 

^^Sa. ^Sx^|XII(380)^ a:6^a ^S6H?I ?leh NT H^H^o^, LHO| 8hHP^B(Hard Disk Drive : HDD) ^ 

Oil XHSaOi SiCf:?^ s.±Lmm (booting) ffH ^S£II2 UI5I ^ 01l££l(main memory) eoll ^XHSD. 

^^fx^oi ^ ^iAH(310)0li:>ll :qiSoPl ^/d^S2!IS(330)0| ^:^ii^(290. 291. 293)^ 2| gSx^l7HI(380) ?IOil 

^XH^CI. eiEi nil 01:^ (operating system interface)(350)^ gSx^U1l(380)2f ^A1^^ 011x1(330), H^n^(370)Zie oiEiuilOl^ 

Aj^^CK -id!A1^Seil^(330)g ii!IAi(310) xn\\2\ :)\^ ^oH gfief >diA|^^ 5101 He.-! £1(340) S Si^s^CK ^Ai^^ B>0| ^di dl (340) 

^ ss, ^Ai(3io) ol^4^£l {^11^1(310) x^x^|2J ae^e ?ie^ ^Ai(3io) aei ^f!iAi{3io)o| o\m ^dispi ^t.^ ^ai 

(310) ^si!A|(310)2[2| m^m ^M{3^0) mO\ ^A1(310)fe ?loH HS^ ^Ai^^ 21! 5! (330)21 J\ 

ggHSn^ ei El mi 01 >i (Application Program Interface : API)(320)S §8H ^IS^^O^ ^ Ai^a2yS(330) ^^OIIAI ^^SU. 

£E 4^ ^•^^soii mm ^±^o\\ 9io\M. ^CH ^>ie2fo| UEHH^ Aii^ §SM euEi^o^fe euEin ^AiM m±^m eiH 

euE4^ ^Mm mj}\m m^^sji Ef^e &Efe[a(B:^i 420). 

42001IA1 ^>i^oj E|oi« nhQSh gjif, £UE1§!M AH^g :?|gOI D\{^Si9im 3^ ^0| SUEHil ^MM ^'J^m £Oi|oi 5^ 

ai A^y^^ s^^oj ogoii euE-is ^joaim ^^^^cl(33^| 430). 

£011 ej 5^ej AitHoii a^s.^ euEH^ i^Mm xissm ^01 &:>ii 42oe 4'^sia(440). 

4200IIAi ^^i^oj E^oig ^jf. SUail ^AiS eXH^^ AHSg ^r^Mil S^.H ^:i5tmO||:>il X\^Si m^MlM ^ g§ 

^se ^si§^cK&:»ii 460). 

ms\ g&OII SUEI§! ^AIM ^^§^a(&:^l 470). 

^6H£i ^ivsh sLiEHi! ^Mm msa ch^^ s^ms oibm^qi^dw aso). 

m9\ c^^^^ a^^Msi d!Ai eyaoii ^:?i suEi^ ^/hm eiHAiE]CK&:?ii 490). 

ejJH. ae^s^ai Ai:±:§iE x^^ioi soneisi m^M:?^ s^^^moii mm: s^e s^exi Ai>:gjoi ^xitsi^xi o\^m B^moi^DW 510). 
ae^s^ai Ai^iiis iis^xi Ai>^goi ii^e i^xitjte ^ ^aim ^^^^a(&:>ii 520). 

Sov^ai Al^ijg ^^oh « >HlAiM g^^^H g^CH^^ 0|§AmCKE^:»1l 530). 

iiEjcn^^ M^^^ olse « /cii/H^ s^cH^^ sr^^oiiAi M\^m euEi^ eel ^U£^ii ^jiiAHoiiTii g^xhsj oia §ss ^2i§[EK 

540). 

« /jiAife eL|E^^ ^AiO||:>|| ^^X\2\ OIS SSM OIOII CHgSf^ C^e s^iMi^F Xh^Moj ^onoi^^ q= SEDlieiOII ^JHo^^XI 

o\^m BBmoiBn 550). 

s:^!^^:?^ SDljoioii ^XHmfe 3^ C^e £01|oi2i AifcHO||:>il ^ AH/HOII CljSh ei^M 2igiSK:K560). 

« {cHAife as £0iie!2i OS o\m^c}(^:^\ 570). 

^ (diAife mriiMoii &iH@ suEii! ^AioiMi ^ Qm gss nsjom b:?ii ssoe 4^^^n::K580). 

^ /cHAi^ DM £oiioioii ^m\t: g^ oiM ni5H ^i^Mi^h ai^ £0iioj2i ae^ ^ai aiw^ sa§hCK590). 

0\9k S ^^S^ :?|^0| S3BII0|H£l2ie S¥ OIM 2^ ^Diioioj /^oiM ^SfOI SHS iDlloi UiS| 2| s^^^ OieAjglQ. 

Av-sh e ^^ss, oie^e Aii^ §s 5i£iM e6H eiEiiii! om m,±^m Afoiw s^oii chshais s^x^si ?ixim 
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^^x[o\\ 2\m oi^cHxi^ M 2, M ssn ^ 9JiO. g^x^2J 9\x\m ^mm9i^^ s^ifoii cue^ ^^oiiAisj cue 

01 Di^m^^ii^ A[om g^oii am oixh ^^^ai i,^^^Ai^ ^ sick seh D\^m ^mm^ shoii ois^e ¥o\m£.^m 

(57) S?2J 
S^S 1. 

S^»2. 

M 1 i^OII kiOiAi. 

^^i>^3. . 

X-ll 1 i>^01l 9JiO\M, 

suEi^ ^Mm Q\^^ M^Moii exHm^ n^s^, q\^^ ^^^21 E}^m m 31 

^::^^M2] Ei^e mi^. suEiiis ?iev AH^^ :'isoi :)H^^£isig 3^ ^01 ^2 ch^^ m.±^9\ tonei ^^^i >mw^ 
^^01! euEi^ ^Aie M^s^fe m 32 

EOiiej 5^e.i Aimoii ^01 ^^s^ euEiS ^aim xhsoHI 31 Byi\m ^^o\^ n\ 33 

s.±^9\ Etse al&^ SiiiM:?^ ah^^ ar^^Mgi ^§ ch^^ ^^iMoii^ii ^s^ixii si ms\ 

n 34 

e&oii ma} siij-^h slieh^! diAig ^iiish^ m 35 

^^S4. 

M 1 L4{xi 3 1,^ e 3^oi£ oii^ g.^ soil sioiAi, cf^^si ^^MM eiEi^M mm ^Aii^ohSAi shsi ^^^e 

s^i>^ 5. 

M 1 ir LHXI Xil 3 S g ^Oi£ CHi^ i^OII SiOiAi, ^^::^| :)[^0| g3£ilOIH£l2iM S¥ Olg 2t £Oiiei ^ai A1WM eoFOl 6HS £CHl 

ei ui2j 2| oieAi^ ^:?i ^ a^iMoii exHS shsi snaioiEAi^i^ b^iim ch si.^3^^ 5!e ^s^^ oie 

x^ « ^^011 am eie ix^s 4=sm^ &:?iim ch s&m^ ^s^^ oiese aii^ §s ^z\m mm s^x^ ^ ^ 

£3 
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